“Tech company” is pretty vague. What he means is social media companies. Still, you can generate your own seed offline then import it into the CC and double check it’s the same. Unless you’re talking about some other specific kind of attack besides seed generation? There was Dark Skippy a while back, but IIRC that’s accounted for by firmware and software. (But maybe not, been a minute since I checked that one.) AFAIK there are still no open source SE’s on the market, although at least one is in development.